Overview

overview

10

Static

static

10

vir.exe

windows7-x64

10

vir.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    240927-mh3m1sxgrm_pw_infected.zip

  • Size

    295.7MB

  • MD5

    9841411533386c9ccd3f0ccf101a90f5

  • SHA1

    8b276c726e8c91bccaedcfded6198c03fbf0a981

  • SHA256

    de59c7b1cef753487469ad372c2dbebfa31043fc403aceeadbb24cab42e79889

  • SHA512

    559707cd15d023f6ea64edef547facdecfda6c11c1802c641939849b91134dfe8a8645f0957c553d67506a39a8ca66b56f87d439a8e573c67f6f7ff75b7a1374

  • SSDEEP

    6291456:UYDbU0KsQ89MMWCh1g/A8onSqiy8Vn6G6rMoKudgt6PQMs/:PD4tsN9MMTh1CKSTQRHKudgt6Pg/

Score
10/10
pdflinkquasarumbralnjrat

Malware Config

Extracted

Family

quasar

Attributes
  • reconnect_delay

    3000

Signatures

  • Detect Umbral payload 1 IoCs
  • Njrat family
    njrat
  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Umbral family
    umbral
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • HTTP links in PDF interactive object 1 IoCs

    Detects HTTP links in interactive objects within PDF files.

    pdflink
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 1 IoCs
    installer

Files

  • 240927-mh3m1sxgrm_pw_infected.zip
    .zip

    Password: infected

  • vir.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections